October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,341
High
5,878
Medium
6,268
Low
649
Severity not reported
3,343
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1317), google (757), oracle (161), ibm (140), adobe (138), broadcom (61), langflow (57), apache (47), apple (43), freerdp (42)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112787 OpenCATS before 0.10.0 contains a missing authorization vulnerability in Reports... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113378 A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111844 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113465 It is possible to execute a DOM-based Cross-Site Scripting attack against Storms... |
medium | 6.6 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2024-2323 The RemoteUserStoreManagerService does not sufficiently validate password change... |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113402 ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vul... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113403 ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulner... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-93878 The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-110180 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-110306 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-96902 The Easy Property Listings WordPress plugin before 3.5.28 does not restrict whic... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-96903 The Easy Property Listings WordPress plugin before 3.5.27 does not perform autho... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-100737 Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) pro... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-109831 UnRTF by GNU Project is vulnerable to out-of-bounds write. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-12489 An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-86963 A denial-of-service issue was addressed with improved input validation. |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86975 An out-of-bounds read was addressed with improved bounds checking. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86976 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86979 A privacy issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86981 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86940 This issue was addressed by removing the vulnerable code. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86944 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-86953 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.6 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86955 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86957 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86959 An input validation issue was addressed with improved input validation. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-86962 A double free issue was addressed with improved memory management. |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86914 An information disclosure issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86915 A race condition was addressed with improved locking. |
medium | 4.7 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86918 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86921 A permissions issue was addressed with improved validation. |
medium | 6.2 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86928 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86932 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86935 This issue was addressed by removing additional entitlements. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-30 |
| CVE-2026-86907 An authorization issue was addressed with improved entitlement checks. |
medium | 4.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86913 A use after free issue was addressed with improved memory management. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86871 An integer underflow was addressed with improved input validation. |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86872 A logic issue was addressed with improved state management. |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86875 An input validation issue was addressed with improved input validation. |
medium | 4.3 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
| CVE-2026-84613 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.